Security
Your data is in good hands.
A booking holds your customer's name, phone number and payment. We take care of that data under the GDPR, and this page says openly how we store and protect it.
Where your data is stored.
Your bookings and customer details are stored in France, on encrypted disks.
Servers in Paris
Let’s Book runs at Scalingo, a French hosting company, in its Paris region. Scalingo is ISO 27001 certified, and certified in France to host health data (HDS).
Private network, encrypted disks
The database sits on encrypted disks, in a private network that the internet can’t reach. Every connection to Let’s Book goes over HTTPS.
Card numbers never reach us
Your customer types card details into a field that Stripe or Mollie serves. The card number goes straight to them and never passes through our servers.
How we protect your data.
These are the measures we take today, from the login to the backups.
Hashed passwords, limited tries
We store passwords as bcrypt hashes and refuse a new one that shows up in a known data breach. After five wrong tries, the login waits 15 minutes.
Two-factor authentication by text
Each team member can turn on a code by text message on top of the password. A trusted device skips the code for 30 days.
Encrypted sessions
The session cookie is encrypted, only travels over HTTPS and is out of reach of scripts on the page. A password reset link you request yourself expires after 15 minutes.
Sensitive answers encrypted
Mark a checkout question as sensitive, and the answers are encrypted with AES-256 in the database. All answers are deleted two weeks after the booking ends.
Hashed API keys, signed webhooks
We store only a hash of each API key, so you see it once. Every webhook carries an HMAC-SHA256 signature with a secret of its own.
Encrypted backups twice a day
An ISO 27001 certified service makes an encrypted backup twice a day, and Scalingo makes one more daily. Every quarter we restore a backup to test it.
Who can see your data.
In your team, you decide what each person sees and does. At Let's Book, only our developers can reach the database.
Roles and permissions
Four roles come with the account, or you build your own from single permissions. A Dock Host sees the day’s planning, not the revenue.
Access per location
You can give a team member access to one dock only. Invite as many people as you like at no charge per user, so nobody has to share a login.
Booking timeline
Every booking shows what changed, who changed it and when. That covers changes by a teammate, by the customer and by the system.
Few people at Let’s Book
Only our developers can reach the production database. Our team uses a password manager and two-factor authentication on every tool that holds data.
Dock Host
Today's planning
Your customers' data under the GDPR.
The data is yours, and we hold it for you. Our general terms say what that means.
You're the controller, we're the processor
Under the GDPR you decide what happens with your customers’ data, and we carry it out. We never process it for our own purposes.
Confidential by contract
What you share with us in confidence stays confidential under the agreement. That binds our own people and anybody we bring in.
GDPR anonymization in one action
Under the GDPR a customer may ask to be forgotten. One action anonymizes their details and removes them from search.
Found a security problem?
Write to tech@lets-book.com with the steps to reproduce it. Our developers read it.